Chinese Hacktool Set - file xai.exe

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the xai.exe executable as part of a Chinese hacktool set to establish persistence or conduct reconnaissance within Azure environments. Proactive hunting is essential because this specific artifact may represent an early-stage intrusion that standard low-severity alerts could overlook, requiring manual validation to confirm its legitimacy before it escalates into a broader compromise.

YARA Rule

rule Pc_xai {
	meta:
		description = "Chinese Hacktool Set - file xai.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
	strings:
		$s1 = "Powered by CoolDiyer @ C.Rufus Security Team 05/19/2008  http://www.xcodez.com/" fullword wide
		$s2 = "%SystemRoot%\\System32\\" fullword ascii
		$s3 = "%APPDATA%\\" fullword ascii
		$s4 = "---- C.Rufus Security Team ----" fullword wide
		$s5 = "www.snzzkz.com" fullword wide
		$s6 = "%CommonProgramFiles%\\" fullword ascii
		$s7 = "GetRand.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file xai.exe detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Microsoft Office Deployment Toolkit (ODT) Execution

  • Context: During scheduled Office 365 updates or new workstation provisioning, the xai.exe utility is frequently invoked by the Microsoft Office Deployment Tool. This tool uses xai.exe to analyze installation logs and generate reports on feature usage before applying patches.
  • Filter/Exclusion: Create an exclusion for processes launched from the path C:\Program Files\Microsoft Office\Office16\ or specifically filter out parent processes named setup.exe (Microsoft Office Setup) when the child process is xai.exe.

• Scenario: Citrix Workspace App Diagnostics

  • Context: In environments utilizing Citrix Virtual Apps and Desktops, the Citrix Workspace application periodically runs diagnostic checks to optimize session performance. The file xai.exe (often part of the Citrix XML Service or Diagnostic Agent) is triggered during user logon sequences or background health checks to capture session metrics.
  • Filter/Exclusion: Exclude xai.exe when the parent process is CitrixWorkspaceApp.exe or wfcrun32.exe. Additionally, restrict the exclusion to the specific installation directory: C:\Program Files\Citrix\ICA Client\.

• Scenario: Automated Log Analysis via PowerShell Scheduled Tasks

  • Context: System administrators often deploy custom PowerShell scripts (e.g., DailyLogAudit.ps1) as scheduled tasks to parse application logs. These scripts may invoke xai.exe as a helper utility to extract binary data or convert log formats for SIEM ingestion, particularly in regions where Chinese-language applications are prevalent.